When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old password as well. It doesn't email me a confirmation code either, the only other way that I could think of confirming that the user really does indeed want to run the action.
Isn't this a possible CSRF vulnerability? For example, I write a website that maliciously includes the reset URL as an image or submits a password reset as part of a form?
I'm not complaining though; it was useful considering I had forgot my password, but was still logged in.